nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-27351 CVE-2023-27351
HIGHCISA KEVRansomwareNuclei
PaperCut NG/MF Improper Authentication Vulnerability
Record summary
CVE-2023-27351 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template. CISA lists CVE-2023-27351 in KEV and reports its use in known ransomware campaigns.
Description
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
Description source: CVE List
Exploitation context
Known exploitation
- CISA KEV
- Listed · Apr 20, 2026 · CISA
- VulnCheck KEV
- Listed · Apr 28, 2023 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
- Ransomware use
- Observed · CISA
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationActive
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 20, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | 22.0.5 (Build 63914) | affected | |
| CISA | Version data not supplied | ||
Nuclei templates
1ProjectDiscoveryHIGHPaperCut NG - Authentication BypassCVSS 8.2
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
Impact
Attackers can bypass authentication, gaining unauthorized access to the system and potentially executing malicious actions.
Remediation
Update to the latest version of PaperCut NG that addresses this issue or apply the security patch provided by the vendor.
WeaknessesCWE-287
Authorsdaffainfo, jjcho
Template tagscve2023cvepapercutauth-bypassvkevkev
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CPE: cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*,cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*
Shodan: http.html:"PaperCut"
Shodan: http.html:"papercut"
Shodan: http.html:"content=\"papercut\""
Shodan: cpe:"cpe:2.3:a:papercut:papercut_mf"
FOFA: body="papercut"
FOFA: body="content=\"papercut\""
https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 https://www.zerodayinitiative.com/advisories/ZDI-23-232/ https://nvd.nist.gov/vuln/detail/CVE-2023-27351
Source: ProjectDiscovery
References
4cisa.govGovernment resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27351 papercut.com
https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 zerodayinitiative.com
https://www.zerodayinitiative.com/advisories/ZDI-23-232